Evidence and trust
Acceptance should confirm MFA coverage for critical roles, secure account recovery, named exception owners, administrator safeguards and risky sign-in alerts. Policy text alone does not prove these controls work in email, VPN or financial systems.
Operational experience
A stable team for IT administration, security, implementation and maintenance of business environments.
Business project delivery
Practical work across support, audits, deployments, maintenance, security and management reporting.
Direct consultation
For an initial review, provide the current password rules, a list of systems without MFA and the account-reset process. We will identify which access paths and privileged roles should be addressed first.
Why the password is still critical
Account attacks often start with password leakage from another site, phishing, password spraying, or a weak reset. If a compromised account has access to email, invoices, SharePoint or administrative panels, the incident quickly goes from a user problem to a company-wide problem.
MFA
MFA limits the impact of password theft, but code-based and approval-prompt methods can still be phished. Prefer phishing-resistant methods such as FIDO2 where the system supports them correctly.
Cybersecurity
Password policy should be part of risk, access and incident management.
Training
Users need to know how to create passwords, use the manager, and report suspicious logins.
Answer first: is a strong password enough?
No. A strong password helps, but business access also needs MFA, a password manager, secure reset, separate administrator accounts, monitoring of risky sign-ins and evidence of periodic reviews. The goal is to reduce account takeover risk without creating rules users bypass.
How does implementation start?
Prioritise administrators, email, VPN and finance. Technical integrations need separate credential and permission controls.
Which controls should work together?
MFA, Microsoft 365, Active Directory, VPN, password manager, phishing response, ISO 27001 and NIS2.
What does Virtline deliver?
Policy, MFA scope, reset procedure, exception register, user instructions and configuration evidence.
A strong password is the first line of defence against cyber threats
A strong password is still the first barrier to account takeover, but it should not be the only one. In the company, the password must work together with MFA, password manager, secure reset, login monitoring and permission restrictions.
- The password should be unique for each system and not used privately.
- Administrative accounts, mail, VPN, and financial systems should have MFA.
- Password reset requires identity verification and review of active sessions.
- If you suspect phishing, you need to check logins, email rules and application access.
Checklist of strong passwords for the company
The best password policy is simple to apply and difficult to bypass. It's worth limiting the number of exceptions, enforcing MFA where risk is high, and giving users tools rather than just bans.
- Use long, unique passwords or phrases generated by your password manager.
- Don't use company names, seasons, dates, personal names, simple sequences or passwords reused from personal accounts.
- Enable MFA for mail, Microsoft 365, VPN, administrators, finance, and customer data systems.
- Block passwords from being stored in sheets, notes, chats and emails.
- Separate administrative accounts from everyday work accounts and limit privileged logins.
- Define the reset procedure: verify identity, terminate active sessions, check MFA and review the logs.
Length, uniqueness and secure password changes
Check new passwords against known breached and common values. Do not require routine changes without evidence of compromise or arbitrary character combinations. Support password managers; an exposed password requires a change and session assessment.
- Use long, unique passwords. NIST SP 800-63B-4 requires at least 15 characters when a password is the only factor; with MFA it permits a minimum of 8. Company policy can require longer passwords with MFA too.
- One password for one system, no repetition between email, SaaS, VPN and private accounts.
- A password manager instead of Excel files, chats, sticky notes and emails.
- Prohibition on sharing passwords without the owner, access history and the procedure for changing them after an employee leaves.
- MFA and monitoring for accounts whose takeover may stop the business process.
The most common mistakes in password policy
The risk often comes not from one weak password, but from the entire process: uncontrolled exceptions, shared access, missing logs, missing MFA, and resets based on an email request alone.
Phishing
The fake login page captures the password and the attacker tries to enter email or VPN.
Password spraying
The attacker tests common passwords across many accounts and relies on some of them not using a second factor.
Lack of education
The user doesn't know when to report a suspicious login, a request for an MFA code, or an unusual reset.
1 password for multiple accounts – use or avoid?
One password for multiple accounts should be avoided. A leak from a private website, store or forum may then open access to company email, VPN or applications with customer data. The company should promote a password manager and ensure that high-risk accounts have MFA.
MFA
Enable MFA on services where the password may previously have been reused. After a leak, change reused passwords and review active sessions.
Security awareness training
Users learn how to create passwords, use the manager and report suspicions.
Cybersecurity
Password policy should be part of broader access and incident controls.
Password policy implementation process and MFA
Test the effect on sign-in and integrations with a controlled group. Prepare account recovery, protected emergency accounts, exception handling and monitoring. Expand deployment while verifying actual MFA coverage.
1. Account inventory
We check mail, Microsoft 365, VPN, applications, administrators, shared accounts and integrations.
2. Policies and exceptions
We set password requirements, MFA, reset methods, conditional access and account owner roles.
3. Communication
We prepare short instructions for users and scenarios for reporting suspicious events.
Password security project deliverables
A password policy is only ready when it can be maintained. The company should have configurations, procedures and a maintenance schedule, not just a provision in a security document.
- Distinguish users from application identities. Unattended workload identities do not perform interactive MFA: they need an owner, least privilege, protected credentials with a managed lifecycle and monitoring. Do not automatically exempt an ordinary user account from MFA.
- List of exception accounts, owners, justifications and next review date.
- Procedure for resetting your password, losing your phone with MFA and suspecting account hijacking.
- User guide: password manager, phishing, reporting unusual requests and protecting MFA codes.
- Supporting evidence: export of settings, implementation logs, list of trained people and a regular audit plan.
Compliance and customer trust
Policies, MFA scope, recovery tests and logs provide evidence for specific access controls. They support assessment of requirements applicable to the company; they do not alone demonstrate full compliance with a standard or regulation.
Related articles
Passwords are part of a broader identity protection, phishing prevention and safe user practices.
Two-factor authentication
How to choose the MFA scope, methods, exceptions and implementation evidence.
Spear-phishing
How targeted attacks steal passwords and MFA codes and manipulate users into unsafe actions.
Personnel and IT security
How to reduce user errors with technical procedures and controls.
